herald-auth-web 0.5.1 → 0.5.2

package/dist/index.d.ts

@@ -558,6 +558,18 @@ interface VerifyTotpPayload {
     backupCode?: string;
     agreements?: ConsentAgreement[];
 }
+interface LdapLoginPayload {
+    /** Directory login identifier (uid / sAMAccountName / UPN). */
+    username: string;
+    password: string;
+    turnstileToken?: string;
+    /** Agreements to satisfy a prior `consent-required` gate. */
+    agreements?: ConsentAgreement[];
+    /** Optional OAuth context, identical to `LoginPayload`. */
+    oauthClientId?: string;
+    redirectUri?: string;
+    state?: string;
+}
 interface PasskeyLoginBeginPayload {
     /** Present for 2FA (after a `requires-second-factor` login); absent for 1FA. */
     tempToken?: string;
@@ -615,6 +627,13 @@ declare function createAuth(deps: AuthDeps): {
         message: string;
     }>;
     login(payload: LoginPayload): Promise<LoginResult>;
+    /**
+     * Corporate-directory (LDAP) login. Mirrors `login()`: the directory
+     * credentials are verified server-side (search-then-bind) and the 200 body
+     * is normalized through the same `toLoginResult` multi-branch handling
+     * (success tokens / second-factor / consent / oauth-redirect).
+     */
+    loginWithLdap(payload: LdapLoginPayload): Promise<LoginResult>;
     verifyTotp(payload: VerifyTotpPayload): Promise<LoginResult>;
     passkey: {
         loginBegin(payload: PasskeyLoginBeginPayload): Promise<PasskeyLoginBeginResult>;
@@ -769,4 +788,4 @@ declare class HeraldError extends Error {
     constructor(init: HeraldErrorInit);
 }
 
-export { type AssertionResultJSON, type BrowserTokenResponse, type ConsentAgreement, type EmailOtpConflict, type EmailOtpSendPayload, type EmailOtpSendResult, type EmailOtpSent, type EmailOtpVerifyPayload, type HeraldClient, type HeraldClientConfig, type HeraldCredentialClass, HeraldError, type HeraldErrorInit, type HeraldErrorKind, type HeraldSession, type LoginConsentRequired, type LoginOauthRedirect, type LoginPayload, type LoginRequiresSecondFactor, type LoginResult, type LoginSuccess, type PasskeyLoginBeginPayload, type PasskeyLoginBeginResult, type PasskeyLoginFinishPayload, type PublicKeyCredentialRequestOptionsJSON, type RegisterPayload, type RequestPasswordResetPayload, type SecondFactor, type SessionEvent, type SetTokensPayload, type StatusResponse, type TokenBridge, type TokenStorage, type TriggerVerifyEmailPayload, type VerifyTotpPayload, createHeraldClient, localStorageStorage, memoryStorage, performPasskeyAssertion };
+export { type AssertionResultJSON, type BrowserTokenResponse, type ConsentAgreement, type EmailOtpConflict, type EmailOtpSendPayload, type EmailOtpSendResult, type EmailOtpSent, type EmailOtpVerifyPayload, type HeraldClient, type HeraldClientConfig, type HeraldCredentialClass, HeraldError, type HeraldErrorInit, type HeraldErrorKind, type HeraldSession, type LdapLoginPayload, type LoginConsentRequired, type LoginOauthRedirect, type LoginPayload, type LoginRequiresSecondFactor, type LoginResult, type LoginSuccess, type PasskeyLoginBeginPayload, type PasskeyLoginBeginResult, type PasskeyLoginFinishPayload, type PublicKeyCredentialRequestOptionsJSON, type RegisterPayload, type RequestPasswordResetPayload, type SecondFactor, type SessionEvent, type SetTokensPayload, type StatusResponse, type TokenBridge, type TokenStorage, type TriggerVerifyEmailPayload, type VerifyTotpPayload, createHeraldClient, localStorageStorage, memoryStorage, performPasskeyAssertion };

package/dist/index.global.js

@@ -1,8 +1,8 @@
-"use strict";var Herald=(()=>{var M=Object.defineProperty;var Le=Object.getOwnPropertyDescriptor;var je=Object.getOwnPropertyNames;var Be=Object.prototype.hasOwnProperty;var qe=(e,r)=>{for(var t in r)M(e,t,{get:r[t],enumerable:!0})},Ke=(e,r,t,s)=>{if(r&&typeof r=="object"||typeof r=="function")for(let n of je(r))!Be.call(e,n)&&n!==t&&M(e,n,{get:()=>r[n],enumerable:!(s=Le(r,n))||s.enumerable});return e};var ze=e=>Ke(M({},"__esModule",{value:!0}),e);var sr={};qe(sr,{HeraldError:()=>g,createHeraldClient:()=>ke,localStorageStorage:()=>z,memoryStorage:()=>Pe,performPasskeyAssertion:()=>Ae});var Y={bodySerializer:e=>JSON.stringify(e,(r,t)=>typeof t=="bigint"?t.toString():t)};var Z=({onRequest:e,onSseError:r,onSseEvent:t,responseTransformer:s,responseValidator:n,sseDefaultRetryDelay:o,sseMaxRetryAttempts:a,sseMaxRetryDelay:l,sseSleepFn:i,url:c,...p})=>{let m,S=i??(d=>new Promise(y=>setTimeout(y,d)));return{stream:async function*(){let d=o??3e3,y=0,b=p.signal??new AbortController().signal;for(;!b.aborted;){y++;let P=p.headers instanceof Headers?p.headers:new Headers(p.headers);m!==void 0&&P.set("Last-Event-ID",m);try{let C={redirect:"follow",...p,body:p.serializedBody,headers:P,signal:b},w=new Request(c,C);e&&(w=await e(c,C));let u=await(p.fetch??globalThis.fetch)(w);if(!u.ok)throw new Error(`SSE failed: ${u.status} ${u.statusText}`);if(!u.body)throw new Error("No body in SSE response");let E=u.body.pipeThrough(new TextDecoderStream).getReader(),k="",_=()=>{try{E.cancel()}catch{}};b.addEventListener("abort",_);try{for(;;){let{done:ve,value:Ge}=await E.read();if(ve)break;k+=Ge,k=k.replace(/\r\n/g,`
+"use strict";var Herald=(()=>{var M=Object.defineProperty;var je=Object.getOwnPropertyDescriptor;var Be=Object.getOwnPropertyNames;var qe=Object.prototype.hasOwnProperty;var Ke=(e,t)=>{for(var s in t)M(e,s,{get:t[s],enumerable:!0})},ze=(e,t,s,r)=>{if(t&&typeof t=="object"||typeof t=="function")for(let n of Be(t))!qe.call(e,n)&&n!==s&&M(e,n,{get:()=>t[n],enumerable:!(r=je(t,n))||r.enumerable});return e};var Me=e=>ze(M({},"__esModule",{value:!0}),e);var nr={};Ke(nr,{HeraldError:()=>g,createHeraldClient:()=>Ie,localStorageStorage:()=>z,memoryStorage:()=>ke,performPasskeyAssertion:()=>ve});var Y={bodySerializer:e=>JSON.stringify(e,(t,s)=>typeof s=="bigint"?s.toString():s)};var Z=({onRequest:e,onSseError:t,onSseEvent:s,responseTransformer:r,responseValidator:n,sseDefaultRetryDelay:o,sseMaxRetryAttempts:a,sseMaxRetryDelay:l,sseSleepFn:i,url:c,...p})=>{let m,S=i??(d=>new Promise(y=>setTimeout(y,d)));return{stream:async function*(){let d=o??3e3,y=0,b=p.signal??new AbortController().signal;for(;!b.aborted;){y++;let P=p.headers instanceof Headers?p.headers:new Headers(p.headers);m!==void 0&&P.set("Last-Event-ID",m);try{let C={redirect:"follow",...p,body:p.serializedBody,headers:P,signal:b},w=new Request(c,C);e&&(w=await e(c,C));let u=await(p.fetch??globalThis.fetch)(w);if(!u.ok)throw new Error(`SSE failed: ${u.status} ${u.statusText}`);if(!u.body)throw new Error("No body in SSE response");let E=u.body.pipeThrough(new TextDecoderStream).getReader(),k="",_=()=>{try{E.cancel()}catch{}};b.addEventListener("abort",_);try{for(;;){let{done:Ge,value:He}=await E.read();if(Ge)break;k+=He,k=k.replace(/\r\n/g,`
 `).replace(/\r/g,`
 `);let $=k.split(`
 
-`);k=$.pop()??"";for(let He of $){let Ue=He.split(`
+`);k=$.pop()??"";for(let Le of $){let Ue=Le.split(`
 `),U=[],Q;for(let R of Ue)if(R.startsWith("data:"))U.push(R.replace(/^data:\s*/,""));else if(R.startsWith("event:"))Q=R.replace(/^event:\s*/,"");else if(R.startsWith("id:"))m=R.replace(/^id:\s*/,"");else if(R.startsWith("retry:")){let X=Number.parseInt(R.replace(/^retry:\s*/,""),10);Number.isNaN(X)||(d=X)}let D,J=!1;if(U.length){let R=U.join(`
-`);try{D=JSON.parse(R),J=!0}catch{D=R}}J&&(n&&await n(D),s&&(D=await s(D))),t?.({data:D,event:Q,id:m,retry:d}),U.length&&(yield D)}}}finally{b.removeEventListener("abort",_),E.releaseLock()}break}catch(C){if(r?.(C),a!==void 0&&y>=a)break;let w=Math.min(d*2**(y-1),l??3e4);await S(w)}}}()}};var Me=e=>{switch(e){case"label":return".";case"matrix":return";";case"simple":return",";default:return"&"}},We=e=>{switch(e){case"form":return",";case"pipeDelimited":return"|";case"spaceDelimited":return"%20";default:return","}},Ve=e=>{switch(e){case"label":return".";case"matrix":return";";case"simple":return",";default:return"&"}},L=({allowReserved:e,explode:r,name:t,style:s,value:n})=>{if(!r){let l=(e?n:n.map(i=>encodeURIComponent(i))).join(We(s));switch(s){case"label":return`.${l}`;case"matrix":return`;${t}=${l}`;case"simple":return l;default:return`${t}=${l}`}}let o=Me(s),a=n.map(l=>s==="label"||s==="simple"?e?l:encodeURIComponent(l):x({allowReserved:e,name:t,value:l})).join(o);return s==="label"||s==="matrix"?o+a:a},x=({allowReserved:e,name:r,value:t})=>{if(t==null)return"";if(typeof t=="object")throw new Error("Deeply-nested arrays/objects aren\u2019t supported. Provide your own `querySerializer()` to handle these.");return`${r}=${e?t:encodeURIComponent(t)}`},j=({allowReserved:e,explode:r,name:t,style:s,value:n,valueOnly:o})=>{if(n instanceof Date)return o?n.toISOString():`${t}=${n.toISOString()}`;if(s!=="deepObject"&&!r){let i=[];Object.entries(n).forEach(([p,m])=>{i=[...i,p,e?m:encodeURIComponent(m)]});let c=i.join(",");switch(s){case"form":return`${t}=${c}`;case"label":return`.${c}`;case"matrix":return`;${t}=${c}`;default:return c}}let a=Ve(s),l=Object.entries(n).map(([i,c])=>x({allowReserved:e,name:s==="deepObject"?`${t}[${i}]`:i,value:c})).join(a);return s==="label"||s==="matrix"?a+l:l};var Fe=/\{[^{}]+\}/g,Ne=({path:e,url:r})=>{let t=r,s=r.match(Fe);if(s)for(let n of s){let o=!1,a=n.substring(1,n.length-1),l="simple";a.endsWith("*")&&(o=!0,a=a.substring(0,a.length-1)),a.startsWith(".")?(a=a.substring(1),l="label"):a.startsWith(";")&&(a=a.substring(1),l="matrix");let i=e[a];if(i==null)continue;if(Array.isArray(i)){t=t.replace(n,L({explode:o,name:a,style:l,value:i}));continue}if(typeof i=="object"){t=t.replace(n,j({explode:o,name:a,style:l,value:i,valueOnly:!0}));continue}if(l==="matrix"){t=t.replace(n,`;${x({name:a,value:i})}`);continue}let c=encodeURIComponent(l==="label"?`.${i}`:i);t=t.replace(n,c)}return t},ee=({baseUrl:e,path:r,query:t,querySerializer:s,url:n})=>{let o=n.startsWith("/")?n:`/${n}`,a=(e??"")+o;r&&(a=Ne({path:r,url:a}));let l=t?s(t):"";return l.startsWith("?")&&(l=l.substring(1)),l&&(a+=`?${l}`),a};function W(e){let r=e.body!==void 0;if(r&&e.bodySerializer)return"serializedBody"in e?e.serializedBody!==void 0&&e.serializedBody!==""?e.serializedBody:null:e.body!==""?e.body:null;if(r)return e.body}var re=async(e,r)=>{let t=typeof r=="function"?await r(e):r;if(t)return e.scheme==="bearer"?`Bearer ${t}`:e.scheme==="basic"?`Basic ${btoa(t)}`:t};var te=({parameters:e={},...r}={})=>s=>{let n=[];if(s&&typeof s=="object")for(let o in s){let a=s[o];if(a==null)continue;let l=e[o]||r;if(Array.isArray(a)){let i=L({allowReserved:l.allowReserved,explode:!0,name:o,style:"form",value:a,...l.array});i&&n.push(i)}else if(typeof a=="object"){let i=j({allowReserved:l.allowReserved,explode:!0,name:o,style:"deepObject",value:a,...l.object});i&&n.push(i)}else{let i=x({allowReserved:l.allowReserved,name:o,value:a});i&&n.push(i)}}return n.join("&")},se=e=>{if(!e)return"stream";let r=e.split(";")[0]?.trim();if(r){if(r.startsWith("application/json")||r.endsWith("+json"))return"json";if(r==="multipart/form-data")return"formData";if(["application/","audio/","image/","video/"].some(t=>r.startsWith(t)))return"blob";if(r.startsWith("text/"))return"text"}},_e=(e,r)=>r?!!(e.headers.has(r)||e.query?.[r]||e.headers.get("Cookie")?.includes(`${r}=`)):!1,ne=async({security:e,...r})=>{for(let t of e){if(_e(r,t.name))continue;let s=await re(t,r.auth);if(!s)continue;let n=t.name??"Authorization";switch(t.in){case"query":r.query||(r.query={}),r.query[n]=s;break;case"cookie":r.headers.append("Cookie",`${n}=${s}`);break;default:r.headers.set(n,s);break}}},V=e=>ee({baseUrl:e.baseUrl,path:e.path,query:e.query,querySerializer:typeof e.querySerializer=="function"?e.querySerializer:te(e.querySerializer),url:e.url}),F=(e,r)=>{let t={...e,...r};return t.baseUrl?.endsWith("/")&&(t.baseUrl=t.baseUrl.substring(0,t.baseUrl.length-1)),t.headers=B(e.headers,r.headers),t},$e=e=>{let r=[];return e.forEach((t,s)=>{r.push([s,t])}),r},B=(...e)=>{let r=new Headers;for(let t of e){if(!t)continue;let s=t instanceof Headers?$e(t):Object.entries(t);for(let[n,o]of s)if(o===null)r.delete(n);else if(Array.isArray(o))for(let a of o)r.append(n,a);else o!==void 0&&r.set(n,typeof o=="object"?JSON.stringify(o):o)}return r},I=class{constructor(){this.fns=[]}clear(){this.fns=[]}eject(r){let t=this.getInterceptorIndex(r);this.fns[t]&&(this.fns[t]=null)}exists(r){let t=this.getInterceptorIndex(r);return!!this.fns[t]}getInterceptorIndex(r){return typeof r=="number"?this.fns[r]?r:-1:this.fns.indexOf(r)}update(r,t){let s=this.getInterceptorIndex(r);return this.fns[s]?(this.fns[s]=t,r):!1}use(r){return this.fns.push(r),this.fns.length-1}},oe=()=>({error:new I,request:new I,response:new I}),Qe=te({allowReserved:!1,array:{explode:!0,style:"form"},object:{explode:!0,style:"deepObject"}}),Je={"Content-Type":"application/json"},A=(e={})=>({...Y,headers:Je,parseAs:"auto",querySerializer:Qe,...e});var v=(e={})=>{let r=F(A(),e),t=()=>({...r}),s=c=>(r=F(r,c),t()),n=oe(),o=async c=>{let p={...r,...c,fetch:c.fetch??r.fetch??globalThis.fetch,headers:B(r.headers,c.headers),serializedBody:void 0};p.security&&await ne({...p,security:p.security}),p.requestValidator&&await p.requestValidator(p),p.body!==void 0&&p.bodySerializer&&(p.serializedBody=p.bodySerializer(p.body)),(p.body===void 0||p.serializedBody==="")&&p.headers.delete("Content-Type");let m=V(p);return{opts:p,url:m}},a=async c=>{let{opts:p,url:m}=await o(c),S={redirect:"follow",...p,body:W(p)},O=new Request(m,S);for(let h of n.request.fns)h&&(O=await h(O,p));let H=p.fetch,d;try{d=await H(O)}catch(h){let u=h;for(let E of n.error.fns)E&&(u=await E(h,void 0,O,p));if(u=u||{},p.throwOnError)throw u;return p.responseStyle==="data"?void 0:{error:u,request:O,response:void 0}}for(let h of n.response.fns)h&&(d=await h(d,O,p));let y={request:O,response:d};if(d.ok){let h=(p.parseAs==="auto"?se(d.headers.get("Content-Type")):p.parseAs)??"json";if(d.status===204||d.headers.get("Content-Length")==="0"){let E;switch(h){case"arrayBuffer":case"blob":case"text":E=await d[h]();break;case"formData":E=new FormData;break;case"stream":E=d.body;break;default:E={};break}return p.responseStyle==="data"?E:{data:E,...y}}let u;switch(h){case"arrayBuffer":case"blob":case"formData":case"text":u=await d[h]();break;case"json":{let E=await d.text();u=E?JSON.parse(E):{};break}case"stream":return p.responseStyle==="data"?d.body:{data:d.body,...y}}return h==="json"&&(p.responseValidator&&await p.responseValidator(u),p.responseTransformer&&(u=await p.responseTransformer(u))),p.responseStyle==="data"?u:{data:u,...y}}let b=await d.text(),P;try{P=JSON.parse(b)}catch{}let C=P??b,w=C;for(let h of n.error.fns)h&&(w=await h(C,d,O,p));if(w=w||{},p.throwOnError)throw w;return p.responseStyle==="data"?void 0:{error:w,...y}},l=c=>p=>a({...p,method:c}),i=c=>async p=>{let{opts:m,url:S}=await o(p);return Z({...m,body:m.body,headers:m.headers,method:c,onRequest:async(O,H)=>{let d=new Request(O,H);for(let y of n.request.fns)y&&(d=await y(d,m));return d},serializedBody:W(m),url:S})};return{buildUrl:V,connect:l("CONNECT"),delete:l("DELETE"),get:l("GET"),getConfig:t,head:l("HEAD"),interceptors:n,options:l("OPTIONS"),patch:l("PATCH"),post:l("POST"),put:l("PUT"),request:a,setConfig:s,sse:{connect:i("CONNECT"),delete:i("DELETE"),get:i("GET"),head:i("HEAD"),options:i("OPTIONS"),patch:i("PATCH"),post:i("POST"),put:i("PUT"),trace:i("TRACE")},trace:l("TRACE")}};var f=v(A());var ae=e=>(e.client??f).post({url:"/api/auth/browser-token/refresh",...e,headers:{"Content-Type":"application/json",...e.headers}});var ie=e=>(e?.client??f).post({security:[{scheme:"bearer",type:"http"}],url:"/api/auth/logout",...e}),le=e=>(e?.client??f).get({security:[{scheme:"bearer",type:"http"}],url:"/api/auth/status",...e});var pe=e=>(e.client??f).post({url:"/api/auth/{realmId}/login",...e,headers:{"Content-Type":"application/json",...e.headers}}),de=e=>(e.client??f).post({url:"/api/auth/{realmId}/login/email-otp/send",...e,headers:{"Content-Type":"application/json",...e.headers}}),ce=e=>(e.client??f).post({url:"/api/auth/{realmId}/login/email-otp/verify",...e,headers:{"Content-Type":"application/json",...e.headers}}),ue=e=>(e.client??f).post({url:"/api/auth/{realmId}/login/passkey/2fa/options",...e,headers:{"Content-Type":"application/json",...e.headers}}),he=e=>(e.client??f).post({url:"/api/auth/{realmId}/login/passkey/2fa/verify",...e,headers:{"Content-Type":"application/json",...e.headers}}),me=e=>(e.client??f).post({url:"/api/auth/{realmId}/login/passkey/options",...e,headers:{"Content-Type":"application/json",...e.headers}}),Ee=e=>(e.client??f).post({url:"/api/auth/{realmId}/login/passkey/verify",...e,headers:{"Content-Type":"application/json",...e.headers}}),fe=e=>(e.client??f).post({url:"/api/auth/{realmId}/login/verify-totp",...e,headers:{"Content-Type":"application/json",...e.headers}});var ye=e=>(e.client??f).post({url:"/api/auth/{realmId}/register",...e,headers:{"Content-Type":"application/json",...e.headers}});var ge=e=>(e.client??f).post({url:"/api/auth/{realmId}/reset_password/request",...e,headers:{"Content-Type":"application/json",...e.headers}});var Te=e=>(e.client??f).post({url:"/api/auth/{realmId}/verify_email/trigger",...e,headers:{"Content-Type":"application/json",...e.headers}});var g=class extends Error{constructor(r){super(r.message??r.kind),this.name="HeraldError",this.kind=r.kind,this.status=r.status,this.code=r.code,this.requestId=r.requestId,this.details=r.details}};function Xe(e){switch(e){case 400:return"validation";case 401:return"unauthorized";case 403:return"forbidden";case 404:return"not-found";case 429:return"rate-limited";default:return"api"}}function q(e,r){if(!r)return new g({kind:"network",message:"Network request failed. For cross-origin integrations, ensure the page origin is pre-registered on the Client App (allowed_origins).",details:e});let t=e??{};return new g({kind:Xe(r.status),status:r.status,message:t.message??t.error??`HTTP ${r.status}`,code:t.code,requestId:t.requestId??void 0,details:t.details})}var Oe="X-Herald-Refresh-Retried",Re="/api/auth/browser-token/refresh";function we(e,r){let t=r.storage.getRefreshToken();if(!t)return r.session.emit({type:"session-expired",reason:"refresh-failed"}),Promise.resolve(null);let s=e.__heraldRefresh;if(s)return s;let n=(async()=>{try{let{data:o,error:a}=await ae({client:e,body:{refreshToken:t}});return a||!o?(r.session.emit({type:"session-expired",reason:"family-revoked"}),null):(r.accessTokenHolder.set(o.accessToken),r.storage.setRefreshToken(o.refreshToken),o)}catch{return r.session.emit({type:"session-expired",reason:"refresh-failed"}),null}finally{e.__heraldRefresh=null}})();return e.__heraldRefresh=n,n}async function Ye(e,r){let t=await e.request(r);if(!t.response)return new Response(null,{status:401});let s=new Headers(t.response.headers),n=t.data!==void 0?t.data:t.error,o=n!=null?JSON.stringify(n):null;return new Response(o,{status:t.response.status,headers:s})}function be(e){let r=v({baseUrl:e.baseUrl});return r.interceptors.request.use((t,s)=>{if(s.url===Re)return t;let n=e.accessTokenHolder.get();if(!n)return t;let o=new Headers(t.headers);return o.has("Authorization")||o.set("Authorization",`Bearer ${n}`),new Request(t,{headers:o})}),r.interceptors.response.use(async(t,s,n)=>{if(t.status!==401||n.url===Re||s.headers.get(Oe)||!(await we(r,e)!==null))return t;let a={...n},l=new Headers(a.headers??void 0);return l.set(Oe,"1"),a.headers=l,Ye(r,a)}),{client:r,refreshTokens:()=>we(r,e)}}async function T(e){let{data:r,error:t,response:s}=await e;if(r===void 0)throw q(t,s);return r}function Ze(e,r){r.accessTokenHolder.set(e.accessToken),r.storage.setRefreshToken(e.refreshToken)}function er(e){return{authenticated:!0,realmId:e.realmId,userId:null,clientAppId:null,clientId:e.clientId,credentialClass:"custom_user_ui",permissions:[],scopes:[]}}function rr(e,r){return{authenticated:e.authenticated,realmId:e.realmId??r.realmId,userId:e.userId??null,clientAppId:e.clientAppId??null,clientId:e.clientId??r.clientId,credentialClass:e.credentialClass??null,permissions:e.permissions??[],scopes:e.scopes??[]}}function Ce(e){return Array.isArray(e)?e.map(r=>{let t=r??{};return{agreementType:String(t.agreementType??t.agreement_type??""),versionId:String(t.versionId??t.version_id??""),...r&&typeof r=="object"?{raw:t}:{}}}):[]}function tr(e){return e.filter(r=>r==="totp"||r==="passkey")}function K(e,r){let t=e??null;if(t&&typeof t.accessToken=="string"){Ze(t,r);let s=er(r);return r.session.emit({type:"authenticated",session:s}),{kind:"success",session:s}}if(t&&t.consentRequired===!0)return{kind:"consent-required",agreements:Ce(t.agreements)};if(t&&Array.isArray(t.secondFactors)&&t.secondFactors.length>0)return{kind:"requires-second-factor",tempToken:String(t.tempToken??""),expiresInSeconds:Number(t.expiresInSeconds??0),secondFactors:tr(t.secondFactors),userId:String(t.userId??""),realmId:String(t.realmId??r.realmId)};if(t&&typeof t.redirectTo=="string")return{kind:"oauth-redirect",redirectTo:t.redirectTo};throw new g({kind:"api",message:"Unrecognized login response shape."})}function De(e){let{realmId:r,client:t}=e;return{async register(s){let n=await T(ye({client:t,path:{realmId:r},body:{clientId:e.clientId,email:s.email,password:s.password,...s.username?{username:s.username}:{},...s.turnstileToken?{turnstileToken:s.turnstileToken}:{}}}));return{message:n.message,verificationRequired:n.verificationRequired}},async triggerVerifyEmail(s){return{message:(await T(Te({client:t,path:{realmId:r},body:{clientId:e.clientId,email:s.email,...s.turnstileToken?{turnstileToken:s.turnstileToken}:{}}}))).message}},async requestPasswordReset(s){return{message:(await T(ge({client:t,path:{realmId:r},body:{clientId:e.clientId,email:s.email,...s.turnstileToken?{turnstileToken:s.turnstileToken}:{}}}))).message}},async login(s){let n=await T(pe({client:t,path:{realmId:r},body:{clientId:e.clientId,password:s.password,...s.username?{username:s.username}:{},...s.email?{email:s.email}:{},...s.turnstileToken?{turnstileToken:s.turnstileToken}:{},...s.agreements?{agreements:s.agreements}:{},...s.oauthClientId?{oauthClientId:s.oauthClientId}:{},...s.redirectUri?{redirectUri:s.redirectUri}:{},...s.state?{state:s.state}:{}}}));return K(n,e)},async verifyTotp(s){let n=await T(fe({client:t,path:{realmId:r},body:{tempToken:s.tempToken,...s.code?{code:s.code}:{},...s.backupCode?{backupCode:s.backupCode}:{},...s.agreements?{agreements:s.agreements}:{}}}));return K(n,e)},passkey:{async loginBegin(s){let n=s.tempToken!==void 0?await T(ue({client:t,path:{realmId:r},body:{tempToken:s.tempToken}})):await T(me({client:t,path:{realmId:r},body:{clientId:e.clientId,...s.turnstileToken?{turnstileToken:s.turnstileToken}:{},...s.oauth?{oauth:s.oauth}:{}}}));return{authToken:n.authToken,options:n.options}},async loginFinish(s){let n=await T(s.tempToken!==void 0?he({client:t,path:{realmId:r},body:{tempToken:s.tempToken,authToken:s.authToken,assertion:s.assertion,...s.agreements?{agreements:s.agreements}:{}}}):Ee({client:t,path:{realmId:r},body:{authToken:s.authToken,assertion:s.assertion,...s.agreements?{agreements:s.agreements}:{}}}));return K(n,e)}},loginWithEmailOtp:{async send(s){let{data:n,error:o,response:a}=await de({client:t,path:{realmId:r},body:{clientId:e.clientId,email:s.email,...s.turnstileToken?{turnstileToken:s.turnstileToken}:{},...s.agreements?{agreements:s.agreements}:{}}});if(n)return{kind:"sent",message:n.message,expiresInSeconds:n.expiresInSeconds};let l=o??{},i=l.code;if(a?.status===409&&(i==="consent_required"||i==="email_not_registered"))return{kind:"conflict",code:String(i),message:String(l.message??""),consentRequired:l.consentRequired===!0,agreements:Ce(l.agreements)};throw q(o,a)},async verify(s){let n=await T(ce({client:t,path:{realmId:r},body:{clientId:e.clientId,email:s.email,code:s.code,...s.agreements?{agreements:s.agreements}:{}}}));return K(n,e)}},async getStatus(){let s=await T(le({client:t}));return e.session.emit({type:"authenticated",session:rr(s,e)}),s},async refresh(){let s=await e.refreshTokens();if(!s)throw new g({kind:"session-expired",message:"Session refresh failed; sign in again."});return s},async logout(){let s=await T(ie({client:t}));return e.accessTokenHolder.clear(),e.storage.setRefreshToken(null),e.session.emit({type:"logged-out"}),{message:s?.message??"Logged out"}}}}function xe(){let e=null;return{get:()=>e,set:r=>{e=r},clear:()=>{e=null}}}var N={authenticated:!1,realmId:null,userId:null,clientAppId:null,clientId:null,credentialClass:null,permissions:[],scopes:[]};function Se(e){let r={...N},t=new Set;return{getSession:()=>r,setSession:s=>{r=s??{...N}},subscribe:s=>(t.add(s),()=>{t.delete(s)}),emit:s=>{s.type==="authenticated"?r=s.session:(s.type==="session-expired"||s.type==="logged-out")&&(r={...N});for(let n of t)n(s);e?.(s)}}}function Pe(){let e=null;return{getRefreshToken:()=>e,setRefreshToken:r=>{e=r}}}function z(e){if(typeof localStorage>"u"||localStorage===null)throw new g({kind:"ssr-no-storage",message:"localStorage is unavailable in this environment. Inject a TokenStorage adapter via `storage`, or use memoryStorage()."});return{getRefreshToken:()=>localStorage.getItem(e),setRefreshToken:r=>{r===null?localStorage.removeItem(e):localStorage.setItem(e,r)}}}function ke(e){let r=typeof localStorage<"u"&&localStorage!==null,t=e.storage;if(!t){if(!r)throw new g({kind:"ssr-no-storage",message:"No TokenStorage adapter was provided and localStorage is unavailable (SSR/Node). Inject a `storage` adapter or use memoryStorage()."});t=z(e.storageKey??"herald.refreshToken")}let s=xe(),n=Se(e.onSessionChange),o=be({baseUrl:e.baseUrl,accessTokenHolder:s,storage:t,session:n}),a={realmId:e.realmId,clientId:e.clientId,client:o.client,accessTokenHolder:s,storage:t,session:n,refreshTokens:o.refreshTokens};return{...De(a),storage:t,session:{getSession:()=>n.getSession(),subscribe:i=>n.subscribe(i)},tokens:{getAccessToken:()=>s.get(),setTokens:i=>{s.set(i.accessToken),t.setRefreshToken(i.refreshToken),i.clientId!==void 0&&(a.clientId=i.clientId)},clear:()=>{s.clear(),t.setRefreshToken(null)},bindClientId:i=>{a.clientId=i}}}}function Ie(e){let r=e.replace(/-/g,"+").replace(/_/g,"/"),t=r+"===".slice((r.length+3)%4),s=atob(t),n=new Uint8Array(s.length);for(let o=0;o<s.length;o+=1)n[o]=s.charCodeAt(o);return n.buffer}function G(e){let r=e instanceof Uint8Array?e:new Uint8Array(e),t="";for(let s=0;s<r.length;s+=1)t+=String.fromCharCode(r[s]??0);return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/[=]/g,"")}async function Ae(e){if(typeof navigator>"u"||!navigator.credentials?.get)throw new Error("WebAuthn (navigator.credentials.get) is not available in this environment.");let r={challenge:Ie(e.challenge),...e.rpId?{rpId:e.rpId}:{},...e.timeout!==void 0?{timeout:e.timeout}:{},...e.userVerification?{userVerification:e.userVerification}:{},...e.allowCredentials?{allowCredentials:e.allowCredentials.map(o=>({type:"public-key",id:Ie(o.id),...o.transports?{transports:o.transports}:{}}))}:{}},t=await navigator.credentials.get({publicKey:r});if(!t)throw new Error("Passkey assertion returned no credential.");let s=t.response,n={id:t.id,rawId:G(t.rawId),type:"public-key",response:{authenticatorData:G(s.authenticatorData),clientDataJSON:G(s.clientDataJSON),signature:G(s.signature),...s.userHandle?{userHandle:G(s.userHandle)}:{}}};return typeof t.getClientExtensionResults=="function"&&(n.clientExtensionResults=t.getClientExtensionResults()),n}return ze(sr);})();
+`);try{D=JSON.parse(R),J=!0}catch{D=R}}J&&(n&&await n(D),r&&(D=await r(D))),s?.({data:D,event:Q,id:m,retry:d}),U.length&&(yield D)}}}finally{b.removeEventListener("abort",_),E.releaseLock()}break}catch(C){if(t?.(C),a!==void 0&&y>=a)break;let w=Math.min(d*2**(y-1),l??3e4);await S(w)}}}()}};var We=e=>{switch(e){case"label":return".";case"matrix":return";";case"simple":return",";default:return"&"}},Ve=e=>{switch(e){case"form":return",";case"pipeDelimited":return"|";case"spaceDelimited":return"%20";default:return","}},Fe=e=>{switch(e){case"label":return".";case"matrix":return";";case"simple":return",";default:return"&"}},j=({allowReserved:e,explode:t,name:s,style:r,value:n})=>{if(!t){let l=(e?n:n.map(i=>encodeURIComponent(i))).join(Ve(r));switch(r){case"label":return`.${l}`;case"matrix":return`;${s}=${l}`;case"simple":return l;default:return`${s}=${l}`}}let o=We(r),a=n.map(l=>r==="label"||r==="simple"?e?l:encodeURIComponent(l):x({allowReserved:e,name:s,value:l})).join(o);return r==="label"||r==="matrix"?o+a:a},x=({allowReserved:e,name:t,value:s})=>{if(s==null)return"";if(typeof s=="object")throw new Error("Deeply-nested arrays/objects aren\u2019t supported. Provide your own `querySerializer()` to handle these.");return`${t}=${e?s:encodeURIComponent(s)}`},B=({allowReserved:e,explode:t,name:s,style:r,value:n,valueOnly:o})=>{if(n instanceof Date)return o?n.toISOString():`${s}=${n.toISOString()}`;if(r!=="deepObject"&&!t){let i=[];Object.entries(n).forEach(([p,m])=>{i=[...i,p,e?m:encodeURIComponent(m)]});let c=i.join(",");switch(r){case"form":return`${s}=${c}`;case"label":return`.${c}`;case"matrix":return`;${s}=${c}`;default:return c}}let a=Fe(r),l=Object.entries(n).map(([i,c])=>x({allowReserved:e,name:r==="deepObject"?`${s}[${i}]`:i,value:c})).join(a);return r==="label"||r==="matrix"?a+l:l};var Ne=/\{[^{}]+\}/g,_e=({path:e,url:t})=>{let s=t,r=t.match(Ne);if(r)for(let n of r){let o=!1,a=n.substring(1,n.length-1),l="simple";a.endsWith("*")&&(o=!0,a=a.substring(0,a.length-1)),a.startsWith(".")?(a=a.substring(1),l="label"):a.startsWith(";")&&(a=a.substring(1),l="matrix");let i=e[a];if(i==null)continue;if(Array.isArray(i)){s=s.replace(n,j({explode:o,name:a,style:l,value:i}));continue}if(typeof i=="object"){s=s.replace(n,B({explode:o,name:a,style:l,value:i,valueOnly:!0}));continue}if(l==="matrix"){s=s.replace(n,`;${x({name:a,value:i})}`);continue}let c=encodeURIComponent(l==="label"?`.${i}`:i);s=s.replace(n,c)}return s},ee=({baseUrl:e,path:t,query:s,querySerializer:r,url:n})=>{let o=n.startsWith("/")?n:`/${n}`,a=(e??"")+o;t&&(a=_e({path:t,url:a}));let l=s?r(s):"";return l.startsWith("?")&&(l=l.substring(1)),l&&(a+=`?${l}`),a};function W(e){let t=e.body!==void 0;if(t&&e.bodySerializer)return"serializedBody"in e?e.serializedBody!==void 0&&e.serializedBody!==""?e.serializedBody:null:e.body!==""?e.body:null;if(t)return e.body}var re=async(e,t)=>{let s=typeof t=="function"?await t(e):t;if(s)return e.scheme==="bearer"?`Bearer ${s}`:e.scheme==="basic"?`Basic ${btoa(s)}`:s};var te=({parameters:e={},...t}={})=>r=>{let n=[];if(r&&typeof r=="object")for(let o in r){let a=r[o];if(a==null)continue;let l=e[o]||t;if(Array.isArray(a)){let i=j({allowReserved:l.allowReserved,explode:!0,name:o,style:"form",value:a,...l.array});i&&n.push(i)}else if(typeof a=="object"){let i=B({allowReserved:l.allowReserved,explode:!0,name:o,style:"deepObject",value:a,...l.object});i&&n.push(i)}else{let i=x({allowReserved:l.allowReserved,name:o,value:a});i&&n.push(i)}}return n.join("&")},se=e=>{if(!e)return"stream";let t=e.split(";")[0]?.trim();if(t){if(t.startsWith("application/json")||t.endsWith("+json"))return"json";if(t==="multipart/form-data")return"formData";if(["application/","audio/","image/","video/"].some(s=>t.startsWith(s)))return"blob";if(t.startsWith("text/"))return"text"}},$e=(e,t)=>t?!!(e.headers.has(t)||e.query?.[t]||e.headers.get("Cookie")?.includes(`${t}=`)):!1,ne=async({security:e,...t})=>{for(let s of e){if($e(t,s.name))continue;let r=await re(s,t.auth);if(!r)continue;let n=s.name??"Authorization";switch(s.in){case"query":t.query||(t.query={}),t.query[n]=r;break;case"cookie":t.headers.append("Cookie",`${n}=${r}`);break;default:t.headers.set(n,r);break}}},V=e=>ee({baseUrl:e.baseUrl,path:e.path,query:e.query,querySerializer:typeof e.querySerializer=="function"?e.querySerializer:te(e.querySerializer),url:e.url}),F=(e,t)=>{let s={...e,...t};return s.baseUrl?.endsWith("/")&&(s.baseUrl=s.baseUrl.substring(0,s.baseUrl.length-1)),s.headers=q(e.headers,t.headers),s},Qe=e=>{let t=[];return e.forEach((s,r)=>{t.push([r,s])}),t},q=(...e)=>{let t=new Headers;for(let s of e){if(!s)continue;let r=s instanceof Headers?Qe(s):Object.entries(s);for(let[n,o]of r)if(o===null)t.delete(n);else if(Array.isArray(o))for(let a of o)t.append(n,a);else o!==void 0&&t.set(n,typeof o=="object"?JSON.stringify(o):o)}return t},I=class{constructor(){this.fns=[]}clear(){this.fns=[]}eject(t){let s=this.getInterceptorIndex(t);this.fns[s]&&(this.fns[s]=null)}exists(t){let s=this.getInterceptorIndex(t);return!!this.fns[s]}getInterceptorIndex(t){return typeof t=="number"?this.fns[t]?t:-1:this.fns.indexOf(t)}update(t,s){let r=this.getInterceptorIndex(t);return this.fns[r]?(this.fns[r]=s,t):!1}use(t){return this.fns.push(t),this.fns.length-1}},oe=()=>({error:new I,request:new I,response:new I}),Je=te({allowReserved:!1,array:{explode:!0,style:"form"},object:{explode:!0,style:"deepObject"}}),Xe={"Content-Type":"application/json"},A=(e={})=>({...Y,headers:Xe,parseAs:"auto",querySerializer:Je,...e});var v=(e={})=>{let t=F(A(),e),s=()=>({...t}),r=c=>(t=F(t,c),s()),n=oe(),o=async c=>{let p={...t,...c,fetch:c.fetch??t.fetch??globalThis.fetch,headers:q(t.headers,c.headers),serializedBody:void 0};p.security&&await ne({...p,security:p.security}),p.requestValidator&&await p.requestValidator(p),p.body!==void 0&&p.bodySerializer&&(p.serializedBody=p.bodySerializer(p.body)),(p.body===void 0||p.serializedBody==="")&&p.headers.delete("Content-Type");let m=V(p);return{opts:p,url:m}},a=async c=>{let{opts:p,url:m}=await o(c),S={redirect:"follow",...p,body:W(p)},O=new Request(m,S);for(let h of n.request.fns)h&&(O=await h(O,p));let L=p.fetch,d;try{d=await L(O)}catch(h){let u=h;for(let E of n.error.fns)E&&(u=await E(h,void 0,O,p));if(u=u||{},p.throwOnError)throw u;return p.responseStyle==="data"?void 0:{error:u,request:O,response:void 0}}for(let h of n.response.fns)h&&(d=await h(d,O,p));let y={request:O,response:d};if(d.ok){let h=(p.parseAs==="auto"?se(d.headers.get("Content-Type")):p.parseAs)??"json";if(d.status===204||d.headers.get("Content-Length")==="0"){let E;switch(h){case"arrayBuffer":case"blob":case"text":E=await d[h]();break;case"formData":E=new FormData;break;case"stream":E=d.body;break;default:E={};break}return p.responseStyle==="data"?E:{data:E,...y}}let u;switch(h){case"arrayBuffer":case"blob":case"formData":case"text":u=await d[h]();break;case"json":{let E=await d.text();u=E?JSON.parse(E):{};break}case"stream":return p.responseStyle==="data"?d.body:{data:d.body,...y}}return h==="json"&&(p.responseValidator&&await p.responseValidator(u),p.responseTransformer&&(u=await p.responseTransformer(u))),p.responseStyle==="data"?u:{data:u,...y}}let b=await d.text(),P;try{P=JSON.parse(b)}catch{}let C=P??b,w=C;for(let h of n.error.fns)h&&(w=await h(C,d,O,p));if(w=w||{},p.throwOnError)throw w;return p.responseStyle==="data"?void 0:{error:w,...y}},l=c=>p=>a({...p,method:c}),i=c=>async p=>{let{opts:m,url:S}=await o(p);return Z({...m,body:m.body,headers:m.headers,method:c,onRequest:async(O,L)=>{let d=new Request(O,L);for(let y of n.request.fns)y&&(d=await y(d,m));return d},serializedBody:W(m),url:S})};return{buildUrl:V,connect:l("CONNECT"),delete:l("DELETE"),get:l("GET"),getConfig:s,head:l("HEAD"),interceptors:n,options:l("OPTIONS"),patch:l("PATCH"),post:l("POST"),put:l("PUT"),request:a,setConfig:r,sse:{connect:i("CONNECT"),delete:i("DELETE"),get:i("GET"),head:i("HEAD"),options:i("OPTIONS"),patch:i("PATCH"),post:i("POST"),put:i("PUT"),trace:i("TRACE")},trace:l("TRACE")}};var f=v(A());var ae=e=>(e.client??f).post({url:"/api/auth/browser-token/refresh",...e,headers:{"Content-Type":"application/json",...e.headers}});var ie=e=>(e?.client??f).post({security:[{scheme:"bearer",type:"http"}],url:"/api/auth/logout",...e}),le=e=>(e?.client??f).get({security:[{scheme:"bearer",type:"http"}],url:"/api/auth/status",...e});var pe=e=>(e.client??f).post({url:"/api/auth/{realmId}/login",...e,headers:{"Content-Type":"application/json",...e.headers}}),de=e=>(e.client??f).post({url:"/api/auth/{realmId}/login/email-otp/send",...e,headers:{"Content-Type":"application/json",...e.headers}}),ce=e=>(e.client??f).post({url:"/api/auth/{realmId}/login/email-otp/verify",...e,headers:{"Content-Type":"application/json",...e.headers}}),ue=e=>(e.client??f).post({url:"/api/auth/{realmId}/login/ldap",...e,headers:{"Content-Type":"application/json",...e.headers}}),he=e=>(e.client??f).post({url:"/api/auth/{realmId}/login/passkey/2fa/options",...e,headers:{"Content-Type":"application/json",...e.headers}}),me=e=>(e.client??f).post({url:"/api/auth/{realmId}/login/passkey/2fa/verify",...e,headers:{"Content-Type":"application/json",...e.headers}}),Ee=e=>(e.client??f).post({url:"/api/auth/{realmId}/login/passkey/options",...e,headers:{"Content-Type":"application/json",...e.headers}}),fe=e=>(e.client??f).post({url:"/api/auth/{realmId}/login/passkey/verify",...e,headers:{"Content-Type":"application/json",...e.headers}}),ye=e=>(e.client??f).post({url:"/api/auth/{realmId}/login/verify-totp",...e,headers:{"Content-Type":"application/json",...e.headers}});var ge=e=>(e.client??f).post({url:"/api/auth/{realmId}/register",...e,headers:{"Content-Type":"application/json",...e.headers}});var Te=e=>(e.client??f).post({url:"/api/auth/{realmId}/reset_password/request",...e,headers:{"Content-Type":"application/json",...e.headers}});var Oe=e=>(e.client??f).post({url:"/api/auth/{realmId}/verify_email/trigger",...e,headers:{"Content-Type":"application/json",...e.headers}});var g=class extends Error{constructor(t){super(t.message??t.kind),this.name="HeraldError",this.kind=t.kind,this.status=t.status,this.code=t.code,this.requestId=t.requestId,this.details=t.details}};function Ye(e){switch(e){case 400:return"validation";case 401:return"unauthorized";case 403:return"forbidden";case 404:return"not-found";case 429:return"rate-limited";default:return"api"}}function K(e,t){if(!t)return new g({kind:"network",message:"Network request failed. For cross-origin integrations, ensure the page origin is pre-registered on the Client App (allowed_origins).",details:e});let s=e??{};return new g({kind:Ye(t.status),status:t.status,message:s.message??s.error??`HTTP ${t.status}`,code:s.code,requestId:s.requestId??void 0,details:s.details})}var Re="X-Herald-Refresh-Retried",we="/api/auth/browser-token/refresh";function be(e,t){let s=t.storage.getRefreshToken();if(!s)return t.session.emit({type:"session-expired",reason:"refresh-failed"}),Promise.resolve(null);let r=e.__heraldRefresh;if(r)return r;let n=(async()=>{try{let{data:o,error:a}=await ae({client:e,body:{refreshToken:s}});return a||!o?(t.session.emit({type:"session-expired",reason:"family-revoked"}),null):(t.accessTokenHolder.set(o.accessToken),t.storage.setRefreshToken(o.refreshToken),o)}catch{return t.session.emit({type:"session-expired",reason:"refresh-failed"}),null}finally{e.__heraldRefresh=null}})();return e.__heraldRefresh=n,n}async function Ze(e,t){let s=await e.request(t);if(!s.response)return new Response(null,{status:401});let r=new Headers(s.response.headers),n=s.data!==void 0?s.data:s.error,o=n!=null?JSON.stringify(n):null;return new Response(o,{status:s.response.status,headers:r})}function Ce(e){let t=v({baseUrl:e.baseUrl});return t.interceptors.request.use((s,r)=>{if(r.url===we)return s;let n=e.accessTokenHolder.get();if(!n)return s;let o=new Headers(s.headers);return o.has("Authorization")||o.set("Authorization",`Bearer ${n}`),new Request(s,{headers:o})}),t.interceptors.response.use(async(s,r,n)=>{if(s.status!==401||n.url===we||r.headers.get(Re)||!(await be(t,e)!==null))return s;let a={...n},l=new Headers(a.headers??void 0);return l.set(Re,"1"),a.headers=l,Ze(t,a)}),{client:t,refreshTokens:()=>be(t,e)}}async function T(e){let{data:t,error:s,response:r}=await e;if(t===void 0)throw K(s,r);return t}function er(e,t){t.accessTokenHolder.set(e.accessToken),t.storage.setRefreshToken(e.refreshToken)}function rr(e){return{authenticated:!0,realmId:e.realmId,userId:null,clientAppId:null,clientId:e.clientId,credentialClass:"custom_user_ui",permissions:[],scopes:[]}}function tr(e,t){return{authenticated:e.authenticated,realmId:e.realmId??t.realmId,userId:e.userId??null,clientAppId:e.clientAppId??null,clientId:e.clientId??t.clientId,credentialClass:e.credentialClass??null,permissions:e.permissions??[],scopes:e.scopes??[]}}function De(e){return Array.isArray(e)?e.map(t=>{let s=t??{};return{agreementType:String(s.agreementType??s.agreement_type??""),versionId:String(s.versionId??s.version_id??""),...t&&typeof t=="object"?{raw:s}:{}}}):[]}function sr(e){return e.filter(t=>t==="totp"||t==="passkey")}function G(e,t){let s=e??null;if(s&&typeof s.accessToken=="string"){er(s,t);let r=rr(t);return t.session.emit({type:"authenticated",session:r}),{kind:"success",session:r}}if(s&&s.consentRequired===!0)return{kind:"consent-required",agreements:De(s.agreements)};if(s&&Array.isArray(s.secondFactors)&&s.secondFactors.length>0)return{kind:"requires-second-factor",tempToken:String(s.tempToken??""),expiresInSeconds:Number(s.expiresInSeconds??0),secondFactors:sr(s.secondFactors),userId:String(s.userId??""),realmId:String(s.realmId??t.realmId)};if(s&&typeof s.redirectTo=="string")return{kind:"oauth-redirect",redirectTo:s.redirectTo};throw new g({kind:"api",message:"Unrecognized login response shape."})}function xe(e){let{realmId:t,client:s}=e;return{async register(r){let n=await T(ge({client:s,path:{realmId:t},body:{clientId:e.clientId,email:r.email,password:r.password,...r.username?{username:r.username}:{},...r.turnstileToken?{turnstileToken:r.turnstileToken}:{}}}));return{message:n.message,verificationRequired:n.verificationRequired}},async triggerVerifyEmail(r){return{message:(await T(Oe({client:s,path:{realmId:t},body:{clientId:e.clientId,email:r.email,...r.turnstileToken?{turnstileToken:r.turnstileToken}:{}}}))).message}},async requestPasswordReset(r){return{message:(await T(Te({client:s,path:{realmId:t},body:{clientId:e.clientId,email:r.email,...r.turnstileToken?{turnstileToken:r.turnstileToken}:{}}}))).message}},async login(r){let n=await T(pe({client:s,path:{realmId:t},body:{clientId:e.clientId,password:r.password,...r.username?{username:r.username}:{},...r.email?{email:r.email}:{},...r.turnstileToken?{turnstileToken:r.turnstileToken}:{},...r.agreements?{agreements:r.agreements}:{},...r.oauthClientId?{oauthClientId:r.oauthClientId}:{},...r.redirectUri?{redirectUri:r.redirectUri}:{},...r.state?{state:r.state}:{}}}));return G(n,e)},async loginWithLdap(r){let n=await T(ue({client:s,path:{realmId:t},body:{clientId:e.clientId,username:r.username,password:r.password,...r.turnstileToken?{turnstileToken:r.turnstileToken}:{},...r.agreements?{agreements:r.agreements}:{},...r.oauthClientId?{oauthClientId:r.oauthClientId}:{},...r.redirectUri?{redirectUri:r.redirectUri}:{},...r.state?{state:r.state}:{}}}));return G(n,e)},async verifyTotp(r){let n=await T(ye({client:s,path:{realmId:t},body:{tempToken:r.tempToken,...r.code?{code:r.code}:{},...r.backupCode?{backupCode:r.backupCode}:{},...r.agreements?{agreements:r.agreements}:{}}}));return G(n,e)},passkey:{async loginBegin(r){let n=r.tempToken!==void 0?await T(he({client:s,path:{realmId:t},body:{tempToken:r.tempToken}})):await T(Ee({client:s,path:{realmId:t},body:{clientId:e.clientId,...r.turnstileToken?{turnstileToken:r.turnstileToken}:{},...r.oauth?{oauth:r.oauth}:{}}}));return{authToken:n.authToken,options:n.options}},async loginFinish(r){let n=await T(r.tempToken!==void 0?me({client:s,path:{realmId:t},body:{tempToken:r.tempToken,authToken:r.authToken,assertion:r.assertion,...r.agreements?{agreements:r.agreements}:{}}}):fe({client:s,path:{realmId:t},body:{authToken:r.authToken,assertion:r.assertion,...r.agreements?{agreements:r.agreements}:{}}}));return G(n,e)}},loginWithEmailOtp:{async send(r){let{data:n,error:o,response:a}=await de({client:s,path:{realmId:t},body:{clientId:e.clientId,email:r.email,...r.turnstileToken?{turnstileToken:r.turnstileToken}:{},...r.agreements?{agreements:r.agreements}:{}}});if(n)return{kind:"sent",message:n.message,expiresInSeconds:n.expiresInSeconds};let l=o??{},i=l.code;if(a?.status===409&&(i==="consent_required"||i==="email_not_registered"))return{kind:"conflict",code:String(i),message:String(l.message??""),consentRequired:l.consentRequired===!0,agreements:De(l.agreements)};throw K(o,a)},async verify(r){let n=await T(ce({client:s,path:{realmId:t},body:{clientId:e.clientId,email:r.email,code:r.code,...r.agreements?{agreements:r.agreements}:{}}}));return G(n,e)}},async getStatus(){let r=await T(le({client:s}));return e.session.emit({type:"authenticated",session:tr(r,e)}),r},async refresh(){let r=await e.refreshTokens();if(!r)throw new g({kind:"session-expired",message:"Session refresh failed; sign in again."});return r},async logout(){let r=await T(ie({client:s}));return e.accessTokenHolder.clear(),e.storage.setRefreshToken(null),e.session.emit({type:"logged-out"}),{message:r?.message??"Logged out"}}}}function Se(){let e=null;return{get:()=>e,set:t=>{e=t},clear:()=>{e=null}}}var N={authenticated:!1,realmId:null,userId:null,clientAppId:null,clientId:null,credentialClass:null,permissions:[],scopes:[]};function Pe(e){let t={...N},s=new Set;return{getSession:()=>t,setSession:r=>{t=r??{...N}},subscribe:r=>(s.add(r),()=>{s.delete(r)}),emit:r=>{r.type==="authenticated"?t=r.session:(r.type==="session-expired"||r.type==="logged-out")&&(t={...N});for(let n of s)n(r);e?.(r)}}}function ke(){let e=null;return{getRefreshToken:()=>e,setRefreshToken:t=>{e=t}}}function z(e){if(typeof localStorage>"u"||localStorage===null)throw new g({kind:"ssr-no-storage",message:"localStorage is unavailable in this environment. Inject a TokenStorage adapter via `storage`, or use memoryStorage()."});return{getRefreshToken:()=>localStorage.getItem(e),setRefreshToken:t=>{t===null?localStorage.removeItem(e):localStorage.setItem(e,t)}}}function Ie(e){let t=typeof localStorage<"u"&&localStorage!==null,s=e.storage;if(!s){if(!t)throw new g({kind:"ssr-no-storage",message:"No TokenStorage adapter was provided and localStorage is unavailable (SSR/Node). Inject a `storage` adapter or use memoryStorage()."});s=z(e.storageKey??"herald.refreshToken")}let r=Se(),n=Pe(e.onSessionChange),o=Ce({baseUrl:e.baseUrl,accessTokenHolder:r,storage:s,session:n}),a={realmId:e.realmId,clientId:e.clientId,client:o.client,accessTokenHolder:r,storage:s,session:n,refreshTokens:o.refreshTokens};return{...xe(a),storage:s,session:{getSession:()=>n.getSession(),subscribe:i=>n.subscribe(i)},tokens:{getAccessToken:()=>r.get(),setTokens:i=>{r.set(i.accessToken),s.setRefreshToken(i.refreshToken),i.clientId!==void 0&&(a.clientId=i.clientId)},clear:()=>{r.clear(),s.setRefreshToken(null)},bindClientId:i=>{a.clientId=i}}}}function Ae(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),s=t+"===".slice((t.length+3)%4),r=atob(s),n=new Uint8Array(r.length);for(let o=0;o<r.length;o+=1)n[o]=r.charCodeAt(o);return n.buffer}function H(e){let t=e instanceof Uint8Array?e:new Uint8Array(e),s="";for(let r=0;r<t.length;r+=1)s+=String.fromCharCode(t[r]??0);return btoa(s).replace(/\+/g,"-").replace(/\//g,"_").replace(/[=]/g,"")}async function ve(e){if(typeof navigator>"u"||!navigator.credentials?.get)throw new Error("WebAuthn (navigator.credentials.get) is not available in this environment.");let t={challenge:Ae(e.challenge),...e.rpId?{rpId:e.rpId}:{},...e.timeout!==void 0?{timeout:e.timeout}:{},...e.userVerification?{userVerification:e.userVerification}:{},...e.allowCredentials?{allowCredentials:e.allowCredentials.map(o=>({type:"public-key",id:Ae(o.id),...o.transports?{transports:o.transports}:{}}))}:{}},s=await navigator.credentials.get({publicKey:t});if(!s)throw new Error("Passkey assertion returned no credential.");let r=s.response,n={id:s.id,rawId:H(s.rawId),type:"public-key",response:{authenticatorData:H(r.authenticatorData),clientDataJSON:H(r.clientDataJSON),signature:H(r.signature),...r.userHandle?{userHandle:H(r.userHandle)}:{}}};return typeof s.getClientExtensionResults=="function"&&(n.clientExtensionResults=s.getClientExtensionResults()),n}return Me(nr);})();
 //# sourceMappingURL=index.global.js.map